Remove user restriction and refactor tests

BrunoQuaresma · BrunoQuaresma · commit 671c56d17d6c · 2022-05-06T13:30:20.000Z
diff --git a/coderd/httpmw/userparam.go b/coderd/httpmw/userparam.go
@@ -76,14 +76,6 @@ func ExtractUserParam(db database.Store) func(http.Handler) http.Handler {
 				}
 			}
 
-			apiKey := APIKey(r)
-			if apiKey.UserID != user.ID {
-				httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
-					Message: "getting non-personal users isn't supported yet",
-				})
-				return
-			}
-
 			ctx := context.WithValue(r.Context(), userParamContextKey{}, user)
 			next.ServeHTTP(rw, r.WithContext(ctx))
 		})
diff --git a/coderd/users_test.go b/coderd/users_test.go
@@ -290,21 +290,38 @@ func TestUpdateUserProfile(t *testing.T) {
 func TestUpdateUserPassword(t *testing.T) {
 	t.Parallel()
 
-	t.Run("Success", func(t *testing.T) {
+	t.Run("MemberCantUpdateAdminPassword", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		coderdtest.CreateFirstUser(t, client)
-		err := client.UpdateUserPassword(context.Background(), codersdk.Me, codersdk.UpdateUserPasswordRequest{
+		admin := coderdtest.CreateFirstUser(t, client)
+		member := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		err := member.UpdateUserPassword(context.Background(), admin.UserID, codersdk.UpdateUserPasswordRequest{
 			Password: "newpassword",
 		})
-		require.NoError(t, err, "update password request should be successful")
+		require.Error(t, err, "member should not be able to update admin password")
+	})
 
-		// Check if the user can login using the new password
+	t.Run("AdminCanUpdateMemberPassword", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		admin := coderdtest.CreateFirstUser(t, client)
+		member, err := client.CreateUser(context.Background(), codersdk.CreateUserRequest{
+			Email:          "coder@coder.com",
+			Username:       "coder",
+			Password:       "password",
+			OrganizationID: admin.OrganizationID,
+		})
+		require.NoError(t, err, "create member")
+		err = client.UpdateUserPassword(context.Background(), member.ID, codersdk.UpdateUserPasswordRequest{
+			Password: "newpassword",
+		})
+		require.NoError(t, err, "admin should be able to update member password")
+		// Check if the member can login using the new password
 		_, err = client.LoginWithPassword(context.Background(), codersdk.LoginWithPasswordRequest{
-			Email:    coderdtest.FirstUserParams.Email,
+			Email:    "coder@coder.com",
 			Password: "newpassword",
 		})
-		require.NoError(t, err, "login should be successful")
+		require.NoError(t, err, "member should login successfully with the new password")
 	})
 }
 

Original file line number	Diff line number	Diff line change
`@@ -76,14 +76,6 @@ func ExtractUserParam(db database.Store) func(http.Handler) http.Handler {`
`76`	`76`	`}`
`77`	`77`	`}`
`78`	`78`
`79`		`- apiKey := APIKey(r)`
`80`		`- if apiKey.UserID != user.ID {`
`81`		`- httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{`
`82`		`- Message: "getting non-personal users isn't supported yet",`
`83`		`- })`
`84`		`- return`
`85`		`- }`
`86`		`-`
`87`	`79`	`ctx := context.WithValue(r.Context(), userParamContextKey{}, user)`
`88`	`80`	`next.ServeHTTP(rw, r.WithContext(ctx))`
`89`	`81`	`})`